njRAT

First seen

2012-01-01 00:00:00

Malware type

rat

Family

Malware family

Operating systems

windows

Related IoCs

12231 (9969 malicious)

Last IoC activity

2026-10-17 03:25:10

Profile updated

2026-07-07 12:47:46

Targeted industries: government-and-public-sector education-and-nonprofits technology-and-telecommunications

Targeted regions: country_code:ae country_code:sa country_code:eg

Context

njRAT is a remote access tool (RAT) that was first observed in 2012. It has been used by threat actors in the Middle East.

Recent IoC activity

9,982 malicious indicators in Maltiverse are attributed to njRAT (S0385). The 20 most recently updated:

Detection coverage

• 9 YARA rules
• 637 Sigma rules

Malware & tools used

• Credentials from Web Browsers (attack-pattern)
• Application Window Discovery (attack-pattern)
• Ingress Tool Transfer (attack-pattern)
• File and Directory Discovery (attack-pattern)
• Query Registry (attack-pattern)
• Peripheral Device Discovery (attack-pattern)
• Video Capture (attack-pattern)
• Screen Capture (attack-pattern)
• Native API (attack-pattern)
• Remote System Discovery (attack-pattern)
• File Deletion (attack-pattern)
• PowerShell (attack-pattern)
• Encrypted/Encoded File (attack-pattern)
• Standard Encoding (attack-pattern)
• Compile After Delivery (attack-pattern)
• Non-Standard Port (attack-pattern)
• Replication Through Removable Media (attack-pattern)
• System Owner/User Discovery (attack-pattern)
• Registry Run Keys / Startup Folder (attack-pattern)
• Remote Desktop Protocol (attack-pattern)
• Keylogging (attack-pattern)
• Web Protocols (attack-pattern)
• Windows Host Firewall (attack-pattern)
• Clear Persistence (attack-pattern)
• Modify Registry (attack-pattern)

Used by threat actors

• Operation Spalax (campaign)
• Gorgon Group (threat-actor)
• Aquatic Panda (threat-actor)
• Transparent Tribe (threat-actor)
• APT-C-36 (threat-actor)
• APT41 (threat-actor)
• LazyScripter (threat-actor)
• Group5 (threat-actor)
• TA2541 (threat-actor)

Detection rules

• SIGNATURE_BASE_HKTL_NET_NAME_RAT_Njrat_0_7D_Modded_Source_Code (yara-rule)
• SIGNATURE_BASE_HKTL_NET_GUID_Njrat (yara-rule)
• SECUINFRA_DROPPER_Njrat_VBS (yara-rule)
• SECUINFRA_MAL_Njrat (yara-rule)
• EMBEERESEARCH_Win_Njrat_Strings_Oct_2023 (yara-rule)
• SEKOIA_Crimeware_Njrat_Strings (yara-rule)
• EMBEERESEARCH_Win_Njrat_Bytecodes_V2_Oct_2023 (yara-rule)
• EMBEERESEARCH_Win_Njrat_Bytecodes_Oct_2023 (yara-rule)
• DITEKSHEN_MALWARE_Win_Cobianrat (yara-rule)

Related threat objects

• Kiler RAT (malware)

Reports & references

• vectra.ai — Moonlight Middle East Targeted Attacks (report)
• secureworks.com — Copper Fieldstone (report)
• Cisco Talos — Sidecopy (report)
• Kaspersky — 91897 (report)
• researchcenter.paloaltonetworks.com — Unit42 Gorgon Group Slithering Nation State Cybercrime (report)
• intezer.com — Intezer 2020 Go Malware Round Up (report)
• intel471.com — China Cybercrime Undergrond Deepmix Tea Horse Road Great Firewall (report)
• spamhaus.org — Botnet Threat Update January To June 2025 (report)
• info.spamhaus.com — Jul Dec%202024%20Botnet%20Threat%20Update (report)
• info.spamhaus.com — Jan Jun%202024%20Botnet%20Threat%20Update (report)
• spamhaus.org — 2020 Q2 Spamhaus Botnet Threat Report (report)
• proofpoint.com — New Whiteshadow Downloader Uses Microsoft Sql Retrieve Malware (report)
• ciphertechsolutions.com — Roboski Global Recovery Automation (report)
• securityintelligence.com — Roboski Global Recovery Automation (report)
• ecucert.gob.ec — Alerta Apts 2022 03 23 (report)
• ti.360.net — Analysis Of Apt C 27 (report)
• MITRE ATT&CK — G0096 (report)
• intel471.com — Privateloader Malware (report)
• bleepingcomputer.com — Fake Microsoft Teams Updates Lead To Cobalt Strike Deployment (report)
• ESET — Eset Threat Report Q22020 (report)
• s3.amazonaws.com — 062521 Sidecopy %281%29 (report)
• s3.amazonaws.com — 062521 Sidecopy %281%29 (report)
• s3.amazonaws.com — Hashes Iocs For Coverage.Txt (report)
• s3.amazonaws.com — Network Iocs List For Coverage.Txt (report)
• pylos.co — Threat Intelligence And The Limits Of Malware Analysis (report)

External references

• mitre-attack — S0385
• LV
• Bladabindi
• FireEye Njw0rm Aug 2013
• Fidelis njRAT June 2013
• Trend Micro njRAT 2018
• Njw0rm
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy